Postgraduate Diploma in Secure Architectures and OT SOC
Online 800 h Postgraduate Diploma in Secure Architectures and OT SOC. 8 modules covering IEC 62443-3-3 (system security requirements for IACS), IEC 62443-2-1 (asset owner security programme) and Wireshark. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Identify the attack surface of industrial control networks and assets.
Apply the IEC 62443 series to OT risk analysis and management.
Design network architectures segmented by zones and conduits.
Define hardening measures for PLCs, HMIs and SCADA servers.
Configure passive monitoring of industrial protocol traffic.
Organise the processes, roles and use cases of an OT SOC.
Coordinate incident response and recovery in industrial environments.
Who it's for
- OT SOC analyst wishing to specialise in Secure Architectures and OT SOC.
- Industrial cybersecurity engineer wishing to specialise in Secure Architectures and OT SOC.
- OT network architect wishing to specialise in Secure Architectures and OT SOC.
- Industrial incident response lead wishing to specialise in Secure Architectures and OT SOC.
- IEC 62443 compliance consultant wishing to specialise in Secure Architectures and OT SOC.
- ICS threat detection specialist wishing to specialise in Secure Architectures and OT SOC.
- Graduates in engineering or sciences seeking to enter the energy and utilities sector.
What you'll work with
- IEC 62443-3-3 (system security requirements for IACS)
- IEC 62443-2-1 (asset owner security programme)
- NIST SP 800-82 Rev. 3 (OT system security)
- Directive (EU) 2022/2555 (NIS2)
- ISO/IEC 27001 (information security management systems)
- ISO/IEC 27035 (security incident management)
- NIST Cybersecurity Framework 2.0
8 modules · 800 h
1.1Purdue model and levels 0 to 5 in industrial plants1.2Industrial protocols: Modbus, DNP3, IEC 104 and OPC UA1.3Differences in priorities between IT and OT1.4Asset inventory: PLCs, RTUs, HMIs and SCADA1.5Reference incidents: Stuxnet, Industroyer and Triton1.6Entry vectors: remote access, USB and suppliers1.7MITRE ATT&CK for ICS matrix1.8Vulnerability lifecycle in industrial firmware1.9ICS-CERT advisories and CVE databases for OT1.10Laboratory: capturing and dissecting Modbus traffic with Wireshark
2.1Structure of the IEC 62443 series2.2Zones, conduits and SL-T security levels2.3IEC 62443-3-3 system requirements2.4IEC 62443-4-2 component requirements2.5NIS2 Directive and operators of essential services2.6NERC CIP in the North American electricity sector2.7Step-by-step IEC 62443-3-2 risk analysis2.8NIST SP 800-82 Rev. 3 guidelines2.9Asset owner security programme2.10Case study: zoning of a substation
3.1Segmentation and microsegmentation of industrial networks3.2Designing an industrial DMZ between IT and OT3.3Firewalls with deep protocol inspection3.4Data diodes and unidirectional transfer3.5Secure remote access with jump hosts and MFA3.6Industrial wireless networks and their protection3.7Secure time synchronisation: PTP and NTP3.8Network redundancy: PRP, HSR and rings3.9Architectures for IEC 61850 substations3.10Workshop: designing a DMZ for a generation plant
4.1Hardening engineering workstations and HMIs4.2Application allowlisting in legacy environments4.3Patch management with maintenance windows4.4Change control for PLC logic4.5Credential management and shared accounts4.6Protection of removable media and scanning kiosks4.7Backups of configurations and projects4.8Signed firmware and secure boot4.9Supply chain security for vendors4.10Practice: hardening plan for a SCADA system
5.1Passive monitoring versus active queries5.2Network sensors and span ports in the plant5.3Baseline-based anomaly detection5.4Signatures and rules for industrial protocols5.5Commercial OT visibility platforms5.6SIEM event correlation with OT sources5.7ICS-specific indicators of compromise5.8PLC telemetry and controller logs5.9Tuning false positives in continuous processes5.10Laboratory: detection rules for anomalous DNP3 commands
6.1SOC models: in-house, outsourced and hybrid6.2OT analyst roles and shifts6.3Integrating the OT SOC with the corporate SOC6.4Use cases prioritised by process impact6.5Triage and escalation procedures6.6Metrics: MTTD, MTTR and asset coverage6.7Threat intelligence on groups targeting ICS6.8Hypothesis-driven threat hunting6.9SOAR automation with process safeguards6.10Case study: use case catalogue for a distributor
7.1Response plans coordinated with operations7.2Containment without compromising functional safety7.3Forensics of PLCs, HMIs and historians7.4Evidence preservation in 24x7 environments7.5Recovery and secure plant restart7.6Relationship with IEC 61511 functional safety7.7Communication with authorities and national CSIRTs7.8Tabletop exercises and drills7.9Lessons learned and continuous improvement7.10Workshop: ransomware simulation in a control centre
8.1Scope definition and critical assets8.2Risk analysis and target security levels8.3Zone and conduit architecture8.4Selection of sensors and data sources8.5Use case and playbook design8.6Team sizing and operating model8.7Phased implementation plan8.8Budget and maturity metrics8.9Report and presentation8.10Final review with the tutor
How you'll learn
Training is 100 % online on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: students progress at their own pace within the intake, which makes it easy to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Zeek, Security Onion, Splunk Enterprise Security, MITRE ATT&CK for ICS (Navigator), in free, academic or evaluation versions. Tests are studied using real OT network lab procedures with PLCs and SCADA, incident response exercises in a simulated environment, and reviews of segmentation by zones and conduits. Assessment is continuous per module, plus the final integrating project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Identify the attack surface of industrial control networks and assets.
Apply the IEC 62443 series to OT risk analysis and management.
Design network architectures segmented by zones and conduits.
Define hardening measures for PLCs, HMIs and SCADA servers.
Configure passive monitoring of industrial protocol traffic.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to read technical standards documentation.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme comprises 800 hours in total, spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with full-time work.
The course uses Wireshark, Zeek, Security Onion, Splunk Enterprise Security, MITRE ATT&CK for ICS (Navigator). Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the final integrating project. It is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or postgraduate diploma in the same area are credited towards the advanced programme. Please check the recognition policy when you enrol.
Related programmes
Postgraduate Diploma in Safety and NFPA/UL Standards for BESS
Online Postgraduate Diploma of 800 hours in safety and NFPA/UL standards for BESS. 8 modules covering NFPA 855 (installation of stationary energy storage systems), UL 9540…
Postgraduate Diploma in Demand and Generation Forecasting
Online 800-hour Postgraduate Diploma in Demand and Generation Forecasting. 8 modules covering Regulation (EU) 2017/1485 (system operation), Regulation (EU) 2017/2195 (electricity balancing) and Python (scikit-learn, statsmodels).…
Postgraduate Diploma in AMI Architectures and Interoperability
Online 800-hour Postgraduate Diploma in AMI Architectures and Interoperability. 8 modules covering IEC 62056 (DLMS/COSEM), ITU-T G.9904 (PRIME) and Wireshark. Assigned tutor and open enrolment.
More in Energy and Networks
All Energy and Networks programmes → · How to apply · Fees & financing · Scholarships